Method and apparatus for providing notification of detected error conditions in a network

ABSTRACT

Methods for managing a communication session in a communication network are disclosed. For example, a method includes detecting, by a first endpoint comprising at least one processor, an error condition associated with the communication session, sending, by the first endpoint, a notification of the error condition to a second endpoint that is using a transport layer session and receiving, by the first endpoint, a communication from the second endpoint, proposing a response to the error condition. Another method includes receiving, by a first endpoint comprising at least one processor, a notification of an error condition associated with the communication session, selecting, by the first endpoint, a response to the error condition, and sending, by the first endpoint, a communication to a second endpoint that is using a transport layer session, proposing a response to the error condition.

This application is a continuation of U.S. patent application Ser. No.14/792,061, filed Jul. 6, 2015, now U.S. Pat. No. 9,769,196, which is acontinuation of U.S. patent application Ser. No. 13/563,455, filed Jul.31, 2012, now U.S. Pat. No. 9,075,953, all of which are hereinincorporated by reference in their entirety.

The present disclosure relates generally to communication networks and,more particularly, to methods, computer-readable media and devices fornotifying other endpoints in a communication session of a detected errorcondition.

BACKGROUND

Numerous devices are capable of using various technologies to accesscommunications networks for voice, data and other forms ofcommunication. For example, user endpoint devices such as mobilehandsets, tablet computers, laptop computers and the like may have thecapability to communicate using cellular access technologies (e.g.,third generation (3G), fourth generation (4G), long term evolution(LTE), global system for mobile communications (GSM), and the like) aswell as packet-based wireless access technologies, such as IEEE 802.11standard, and others. In general, in various Transmission ControlProtocol (TCP)/Internet Protocol (IP) network implementations, thetransport layer does not provide end-to-end message transfercapabilities independent of the underlying network. Namely, in thecurrent TCP/IP protocol family, TCP and User Datagram Protocol (UDP) arenot independent of the network layer protocol (e.g., IP). Thus, messagetransfer is enabled between pairs of IP addresses and layer four (L4)port tuples.

SUMMARY

In one embodiment, the present disclosure provides methods and devicesfor managing a communication session in a communication network. Forexample, in one embodiment a method includes detecting, by a firstendpoint comprising at least one processor, an error conditionassociated with the communication session, sending, by the firstendpoint, a notification of the error condition to a second endpointthat is using a transport layer session; and receiving, by the firstendpoint, a communication from the second endpoint, proposing a responseto the error condition.

In another embodiment, a method includes receiving, by a first endpointcomprising at least one processor, a notification of an error conditionassociated with the communication session, selecting, by the firstendpoint, a response to the error condition, and sending, by the firstendpoint, a communication to a second endpoint that is using a transportlayer session, proposing a response to the error condition.

BRIEF DESCRIPTION OF THE DRAWINGS

The teachings of the present disclosure can be readily understood byconsidering the following detailed description in conjunction with theaccompanying drawings, in which:

FIG. 1 illustrates an exemplary LTE based network related to the presentdisclosure;

FIG. 2 illustrates an exemplary packet format, according to the presentdisclosure;

FIG. 3 illustrates a flowchart of a method for managing the security ofa communication session in a communication network, according to thepresent disclosure;

FIG. 4 illustrates a flowchart of a further method for managing thesecurity of a communication session in a communication network,according to the present disclosure; and

FIG. 5 illustrates a high level block diagram of a general purposecomputer suitable for use in performing the methods, operations andfunctions described herein.

DETAILED DESCRIPTION

The present disclosure provides novel methods and devices for managingthe security of a session in a communication network. For the purpose ofthis disclosure, the use of the terms “transport layer communicationsession”, and “transport layer session”, are all referring to a sessionthat is established at the transport layer. In one embodiment, thepresent disclosure involves an established transport layer communicationsession (e.g., a TCP or TCP/IP session or a UDP session). In oneembodiment, the present disclosure provides a novel TCP packet (orsegment) structure that enables protocol extensibility and facilitatesthe transfer, or re-anchoring of a session as the IP address of anendpoint changes, without tearing down the existing session andreestablishing a new session and without tunneling of the connection.Embodiments of the present disclosure will be referred to herein as TCPversion 2, or TCPv2. However, it should be noted that TCPv2, asdisclosed herein, may replace both TCP as well as UDP. In this regard,it should be noted that embodiments of the present disclosure involvecommunication sessions in general but in some instances thecommunication sessions are at the transport layer, e.g., layer 3according to the TCP/IP network model, or layer 4 according to the OpenSystems Interconnection reference model—in other words, where thecurrent versions of TCP and UDP presently operate. The structure of anexemplary TCPv2 packet is described in greater detail below inconnection with FIG. 2. A more detailed discussion of the establishmentand re-anchoring of a TCPv2 session can be found in the co-pending andcommonly assigned application No. 13/563,403, “Method And Apparatus ForInitiating And Maintaining Sessions Between Endpoints”, having and filedon the same date herewith, the entirety of which is incorporated byreference herein.

As disclosed herein, TCPv2 provides the opportunity for securityenhancements over the current TCP protocol. In particular, when asuspected attack on a communication session or other failure conditions(both of which are broadly referred to as error conditions) is detected(e.g., by one of the endpoints), the existing TCP protocol, as well asother session-oriented protocols, provides for two responses: either todrop the session or to ignore the suspected attack. Several deficienciesexist with this arrangement. First, if an endpoint determines that thesession should be dropped, the endpoint simply drops the session.However, there is no explicit notification to one or more otherendpoints involved in the session. As such, the other endpoint(s) maycontinue to send packets into the network and may still expect toreceive packets from the other endpoint(s). This may lead to dataleakage. For example, while the session may be compromised the non-awareendpoints may still continue to send packets into the network until atimeout condition occurs (e.g., failure to receive an acknowledgmentwithin a particular timeframe). In addition, in the case of aman-in-the-middle attack, it may appear to the non-aware endpoints thatthe session is continuing even though a peer endpoint may have alreadydropped the session. For example, the man-in-the-middle can receive andrespond to packets and spoof source and/or destination IP address andTCP (or user datagram protocol (UDP)) port numbers such that thenon-aware endpoints still believe they are involved in a communicationsession with the endpoint that has already dropped the session.

On the other hand, it may also be problematic for other endpoints whenan endpoint that detects a potential attack and/or failure condition(both of which are broadly referred to as error conditions) simplydecides to ignore the threat. For example, the endpoint detecting thepotential threat may determine that despite the existence of the threat,no action should be taken because the endpoint itself may not beconcerned with the detected threat. For example, the session may beconveying to a website non-private information that is freely available,and it is of no consequence that data is leaked to a third-party.However, one or more other endpoints in the session may have a strictersecurity policy and would drop the session if they were aware of thedetected attack. For example, an endpoint may deem it appropriate todrop a session notwithstanding that it is simply accessing publicinformation from a non-password protected public webpage. It may simplybe enough that a third-party is attempting to eavesdrop upon thecommunication. Notably, the existing TCP standards do not adequatelyaddress these concerns. In addition UDP has similar deficiencies tothose discussed in greater detail herein with respect to TCP.

In contrast to the foregoing, embodiments of the present disclosureprovide for explicit notification and sharing of information regardingdetected attacks/failure conditions between endpoints in a communicationsession (e.g., in a TCPv2 session or a TCP session). In this regard, itshould be noted that embodiments of the present disclosure apply equallyto attacks as well as failure conditions. Thus, an attack or a failurecondition as referred to herein may each be considered broadly as an“error condition”. It should be noted that the attack may be associatedwith the transport session layer or another communication session layer.However, in one embodiment, the communication as to how to address thedetected attack occurs at the transport session layer. In addition,embodiments of the present disclosure provide for alternative responsesaside from the binary choice of taking no action or dropping thesession. For example, the endpoints in a communication session cancollectively determine a response to take following the detection of afailure condition/attack on the communication session. The response maycomprise: dropping the session, continuing the session, logging thesession, changing session identifiers, re-negotiating a session key,beginning to use encryption, if none is currently used, upgrading to amore secure cipher suite, re-anchoring or transferring the session to adifferent network and/or a different device, and the like, rather thanjust a unilateral decision to drop or continue. Advantageously, wheremultiple endpoints of a session determine a collective security action,it prevents data leakage and provides the opportunity for all of theendpoints to apply local security policies following the detection of afailure condition/attack. For example, if the endpoints collectivelydetermine to drop a session, no endpoints will continue to send datainto the network after the decision is made. In addition, if an endpointthat first detects an attack has a security policy that would ignore theattack, but another endpoint which is notified of the attack has astricter security policy, the other endpoint is given the opportunity toaffect the response to the attack (e.g., to drop the session, re-anchorto a more secure network, change session identifiers, etc.).

To better understand the present disclosure, FIG. 1 illustrates anexemplary network 100 related to the present disclosure (e.g., a ThirdGeneration Partnership Project (3GPP) Long Term Evolution (LTE)network). Although the present disclosure is described in the context ofLTE networks, the disclosure is not so limited. Namely, the presentdisclosure can be equally applied to other types of networks (e.g.,wired networks, such as digital subscriber line (DSL) networks, cablenetworks and optical networks, wireless networks, such as IEEE 802.11(Wi-Fi) networks and WiMAX networks, other cellular network such asGlobal System for Mobile Communications (GSM) Enhanced Data rates forGSM Evolution (EDGE) networks and Universal Mobile TelecommunicationsSystem (UMTS) code division multiple access (CDMA) networks, satellitenetworks, etc.), as well communications traversing various combinationsof such networks. In one illustrative embodiment, the LTE network 100comprises an access network 102 (e.g., an evolved Universal TerrestrialRadio Access Network (eUTRAN)), a backhaul network 109, a core network103 (e.g., an Evolved Packet Core (EPC) network). Furthermore, althoughvarious networks are shown as separate networks in FIG. 1, it ispossible that functions performed by these networks can be combined intofewer networks or expanded into a greater number of networks dependingon the deployment requirements.

In one illustrative example, the eUTRAN, e.g., eUTRAN 102, may compriseone or more evolved NodeBs (eNodeBs), e.g., 111. In operation, anendpoint device such as user equipment (UE) 101 may access wirelessservices via an eNodeB, e.g., eNodeB 111 in the eUTRAN 102. UE 101 canbe a smart phone, a cellular phone, a computing tablet, a computer orlaptop, or any endpoint communication device equipped with wirelesscapabilities. An eNodeB, such as eNodeB 111, provides wirelessinterfaces to one or more UE devices. All eNodeBs in the eUTRAN 102 areconnected to the EPC network 103 via one or more integrated accessdevices 105 (e.g., a Smart Integrated Access Device (SIAD)) located in abackhaul network 109. Broadly, an integrated access device is capable ofintegrating both voice and data services within a single device. In oneembodiment, eNodeB 111 supports wireless services covered by one or morecell sites located in eUTRAN 102. It should be noted that any number ofeNodeBs can be deployed in eUTRAN 102.

In one embodiment, eUTRAN 102 is connected to the EPC network 103 viathe backhaul network 109. For example, SIAD 105 in the backhaul network109 is connected to the EPC network 103 via a Multi-service Node (MSN)106. An EPC network provides various functions that support wirelessservices in the LTE environment. In one embodiment, an EPC network is anInternet Protocol (IP) packet core network that supports both real-timeand non-real-time service delivery across a LTE network.

In one embodiment, a SIAD is a device that provides wireless trafficaggregation and backhaul from a cell site to an EPC network. AMulti-Service Node (MSN) provides layer 2 and layer 3 networkingfunctions for wireless service between one or more SIADs and the EPCnetwork. The eUTRAN 102 is the air interface of the 3GPP's Long TermEvolution (LTE) specifications for mobile networks. Namely, the eUTRANcomprises a radio access network standard that will replace previousgenerations of air interface standards. In one embodiment, the SIAD 105and the MSN 106 communicate over a backhaul network 109. The backhaulnetwork may also be referred to as a metro Ethernet transport network.

In EPC network 103, network devices such as Mobility Management Entity(MME) 107 and Serving Gateway (SGW) 108 support various functions aspart of the LTE network 100. For example, MME 107 is the control nodefor the LTE access-network. In one embodiment, it is responsible for UE(User Equipment) tracking and paging (e.g., such as retransmissions),bearer activation and deactivation process, selection of the SGW, andauthentication of a user. In one embodiment, SGW 108 routes and forwardsuser data packets, while also acting as a mobility anchor for the userplane during inter-eNodeB handovers.

In addition, EPC (common backbone) network 103 may comprise a HomeSubscriber Server (HSS) 191 that contains subscription-relatedinformation (e.g., subscriber profiles), performs authentication andauthorization of a wireless service user, and provides information aboutthe subscriber's location. The EPC network 103 may also comprise aPolicy and Charging Enforcement Point (PCEF) 192 that supports accessesto subscriber databases and specialized functions of a charging system.The EPC network 103 may also comprise a Public Data Network Gateway (PDNGW) 193 (which may also be referred to as a packet data gateway (PDG orPGW) or evolved packet data gateway (ePDG)) which serves as a gatewaythat provides access between the EPC network 103 and various datanetworks, e.g., other IP networks, trusted or non-trusted networks194-196 and the like. In one embodiment, a PDW may serves as an anchorfor mobility between LTE and other wireless technologies, such as 2G and3G wireless networks.

In one embodiment, the eUTRAN network 102, the backhaul network 109 andthe EPC network 103 include various data bearer paths and signalingbearer paths, which may be referred to by specific labels. For example,the data bearer path on line 152 may be referred to as an S1-U bearerpath and the data bearer path on line 153 may be referred to as an S5 oran S8 bearer path. In another example, the signaling bearer path betweenthe eUTRAN and the MME 107 may be referred to as an S1-MME bearer path.Shown illustratively in FIG. 1, the S1 interface flow 152 is used toprovide communication between an eNodeB, such as eNodeB 111, and adevice in the EPC network 103, such as MME 107 and/or SGW 108. The SGiinterface flow 154 is used to provide communication between the PGW 193(also referred to as PDN GW 193) and the PCEF 192. The S5/S8 interfaceflow 153 is used to provide communication between the SGW 108 and PGW193. It should be noted that the S1, S5, S8 and SGi interfaces arestandard interfaces defined by the 3GPP standard. However, the presentdisclosure is not limited to these specific interfaces. In addition, itshould be noted that LTE network 100 of FIG. 1 is only illustrative innature. Thus, the number of network components or elements is notspecifically limited as shown, and any number of network components orelements can be deployed.

FIG. 2 illustrates an exemplary TCPv2 packet (or segment) format. Itshould be noted that TCP terminology generally refers to the datastructure as a “segment” whereas other protocols, such as user datagramprotocol (UDP) refer to a “packet.” In the context of the presentdisclosure, the two terms are used interchangeably, both referring to atransport layer data structure for transmission of information over acommunication network. As shown in FIG. 2, the TCPv2 packet 200 includesa header 210 and a payload 220. Within the header 210 there are severalfields including a source port field 212, a destination port field 214,a record type field 216 and a length field 218. Notably, the source portand destination port fields 212 and 214 do not correspond to the wellknow ports as used in TCP. Rather, the destination port field 214 isreserved for carrying a requesting system session ID (RSID) and thesource port field 212 is reserved for carrying a serving system sessionID (SSID). The RSID and SSID are unique values selected by therequesting system and the serving system respectively, and are used touniquely identify a TCPv2 session. For example, an endpoint that startsa session may be the “requesting system” and may select the RSID. Theendpoint that it is attempting to connect to may comprise the “servingsystem” and may select the SSID. Notably, the session identity has nodependence upon the IP addresses of the hosts (i.e., the requesting andserving system). Rather, it is defined only by the RSID and SSIDcombination (each of the RSID and SSID respectively being used dependingupon the direction of the communication). In one embodiment, each of thehosts selects its own session ID and shares the selected session ID withthe other host. In one embodiment, each of the session IDs is a 32 bitword. Hence, the source port and destination port fields 212 and 214 ofthe header 210 of TCPv2 packet 200 reserve 32 bits for each of the RSIDand SSID. The use of RSID and SSID to identify a session enables thesession to survive re-anchoring or transferring the session to differentnetwork, different IP address and/or different endpoint device, incontrast to the existing TCP/IP session being identified by thecombination of IP address and TCP port number.

The exemplary header of a TCPv2 packet 200 also includes a record typefield 216. The record type field 216 is reserved for a record type,which indicates the type of payload of the packet. In the context of thepresent disclosure, several exemplary record types for supporting themanagement of the security of a communication session are discussedbelow. The exemplary TCPv2 packet 200 also includes a length field 218,indicating a length of the packet. This helps to prevent exploits thatseek to append additional data to a packet. The exemplary TCPv2 packetalso includes a payload 220. The length, structure and contents of thepayload 220 will vary depending upon the particular record type andpurpose of the packet.

Notably, each of the TCPv2 data packets used in a session isencapsulated in a network layer header (e.g., an IP header) having atleast a source IP address and a destination IP address. However, nochanges to the Internet Protocol or to the IP headers is necessary.TCPv2 packets are compatible with all versions of the Internet Protocol(e.g., IPv4, IPv6, etc., and other layer 3 protocols). Thus, theencapsulation of a transport layer packet/frame with a network layer IPheader/IP datagram may be performed in a manner understood by thoseskilled in the art.

In one embodiment, each of the hosts/endpoint devices in a session maymaintain a session management table for the session storing the sessionparameters, which may include the current IP address of the peer host.Notably, the source IP address and destination IP address correspond tothe initial IP addresses of the requesting host and the destination hostat the time a session is established. However, a first device or hostmay change its IP address and notify one or more peer devices through asession re-anchor. In one embodiment, re-anchoring is achieved by adevice sending a session re-anchor packet to one or more peers in thesession. For instance, packet 200 may include a record type of “REAN”(re-anchor) in the record type field, indicating that the payload of thepacket includes, at a minimum, a new IP address for communicating withthe device. Upon receiving a REAN message, a peer device may then updateits session management table to include the new IP address of the firstdevice (as well as drop the old IP address), and begin sendingcommunications (e.g., subsequent TCPv2 packets encapsulated in IPheaders/IP datagrams) to the new IP address. Since the TCPv2 headerincludes a serving system session ID (SSID) field and a receiving systemsession ID (RSID) field, a session is tied to these unique identifiers,rather than IP address/L4 port tuples (as in the existing version ofTCP). As such, sessions (using TCPv2) can survive a change in networkthrough “re-anchoring” (e.g., watch a movie on a landline-connectedtablet, switch to a mobility network, seamlessly).

In one embodiment, one or more of the messages exchanged in a sessionmay comprise packets (e.g., in the form of TCPv2 packet 200) which areencrypted using a secret session key that is only known to the endpointdevices in the session. For example, in one embodiment when a session isfirst established a session key is negotiated using a Diffie-Hellman keyexchange protocol. Each of two peers agrees to use a particular primenumber and a base. These two numbers may be public. However, each of thetwo peers then selects a secret number, applies a formula according toDiffie-Hellman and sends the result to the peer device, which appliesthe inverse of the formula to receive the secret number of the otherdevice. Having selected its own secret number and having determined thesecret number of the peer, each of the peers is then able to calculate ashared secret key that can only be created by using both of the secretnumbers. Notably, each of the peers is able to calculate the same secretkey based upon having both of the secret numbers selected by the peers.The secret key is then used as a “session key.” Thus, some or all of themessaging between the peers may then be encrypted prior to transmissionusing the session key. Advantageously, by requiring that allre-anchoring request packets be encrypted using the session key, devicesin the communication session may discern spurious re-anchor requests.For example, a man-in-the-middle attacker may send a re-anchor requestto one of the endpoints attempting to have the endpoint update itssession management table to include an IP address of the attacker'sdevice. However, if the session re-anchor request packet is notencrypted using the session key, the endpoint receiving the re-anchorrequest may know that the request is not legitimate. As such, thedetection of an invalid re-anchor request may trigger a securitymanagement procedure according to embodiments of the present disclosure.

Following from the foregoing, in one embodiment the packet 200 is usedfor messaging (e.g., OA&M messaging) in connection with managing thesecurity of a communication session. In particular, the payload ofpacket 200 may be used to convey information to peer endpointsdescribing details of a detected attack. Similarly, the payload ofpacket 200 may be used to propose a particular response to the detectedattack, to confirm that a proposed response to a detected attack isacceptable or to propose a different response to the detected failurecondition/attack. In this regard, different record types may be placedin the record type field to indicate the different purposes of thepackets and the different information to be found in the payloads. Forexample, for purposes of the present disclosure a record type of ANM(attack notification message) may indicate that the payload of packet200 is for providing details of the detected attack. A record type ofPSA (proposed security action), may indicate that the payload of thepacket 200 is for indicating a proposed security action to take inresponse to a detected attack. For instance, an endpoint may receive apacket 200 having a record type of ANM from a peer endpoint. Afterprocessing the information contained in the ANM message the endpoint mayselect a security action/response to the detected attack and, in turn,send a packet 200 having a record type of PSA proposing the selectedresponse to the peer endpoint. In one embodiment, a record type of SAC(security action confirmation) may indicate that a payload of packet 200includes a confirmation of a proposed response. The confirmation mayinclude a positive confirmation or a negative confirmation. For example,a positive confirmation may include an indication that the proposedsecurity action is accepted by an endpoint (e.g., in response toreceiving a PSA message from a peer device). A negative confirmation mayeither explicitly decline the proposed response/security action conveyedin the PSA message, or may proposed a different or alternativeresponse/security action to take in response to the detected attack. Inone embodiment, to provide enhanced security, management packets such asANM, PSA and SAC are encrypted using the session key described above. Inshort, the packet structure 200 supports a notification of a detectedfailure condition/attack and the negotiation of an appropriate responseto a detected attack.

FIG. 3 illustrates an exemplary method 300 for managing security of acommunication session (e.g., the transport layer in one embodiment andany other layers) in a communication network (e.g., a session usingTCPv2 packets). In one embodiment, the method 300 may be performed by afirst endpoint device in an ongoing communication session with one ormore other endpoint devices. For instance, the method 300 may beperformed by endpoint device/user equipment 101 in FIG. 1 incommunication with endpoint device/user equipment 151. It should benoted that in the present context an endpoint device may also comprise aserver, requesting host, destination host or other peer device that ispart of a communication session and is not strictly limited to a “userequipment” such as a cellular telephone, a smart phone, a computingtablet, a desktop or laptop computer and the like. In one embodiment, anendpoint device may execute one or more applications or applicationprograms which perform one or more steps/functions/operations of themethod 300. For example, the application or application programs maycomprise computer readable code and/or instructions stored on a memoryand executed by a processor of the endpoint device. Alternatively, or inaddition, one or more of the steps/functions/operations of the method300 may be performed by a security manager which, in one embodiment, mayalso comprise an application or application program that is executed byan endpoint device. In addition, in one embodiment, thesteps/functions/operations of method 300 may also be performed by acomputing device 500 as described in connection with FIG. 5.

The method 300 begins in step 302 and proceeds to step 310 where themethod detects an error condition of the communication session, e.g., atransport layer session. For example, a first endpoint in acommunication session may detect an error condition of the communicationsession in any of a number of ways and for any of a number of reasons.For instance, an attack, or a suspected attack, may be detected uponreceiving a packet and determining that the packet comprises animproperly formed session management/OA&M message, such as an improperlyformed or improperly encrypted re-anchor request, attack notificationmessage, session transfer message, and the like. For example, an attackmay seek to append malicious code to the end of a packet, but the methodmay detect that the packet exceeds a session parameter of a maximumpacket size agreed upon between the endpoints of the communicationsession during session setup. In one embodiment, the detected failurecondition/attack may comprise an attempt to hijack a session or asuccessful hijacking of the session. For instance, an attack maycomprise a denial of service attack. In one embodiment, the denial ofservice attack may comprise a large number of re-anchor requests orother improper OA&M messages having the only purpose of tying upresources of one or more of the endpoints in the communication session.In one embodiment, at step 310 the method 300 may additionally oralternatively detect one or more failure conditions such as a badgateway, a broken link, and the like. In one embodiment, an errorcondition may arise where there is an unsuccessful attempt to hijack acommunication session which nevertheless causes the legitimate endpointsto the session to be completely or partially unable to communicate(e.g., by tying up resources by flooding a large number of bogusmessages through the network and/or to the endpoints of the session).Thus, where the present disclosure describes responses to a detectedattack, it should be understood that in other, further and differentembodiments a detected “failure condition” may be handled insubstantially the same manner.

Following step 310, the method proceeds to step 320, or optionally tostep 315. At step 315, the method 300 determines if there are anysuppression timers for the detected attack (and/or failure condition).For instance, if this is not the first detection of the same event andif the other endpoint is already notified, the method 300 does notnecessarily need to send an additional notification of the event. Assuch, the method 300 may maintain one or more suppression timers for oneor more previously detected events. In one embodiment, if the method 300determines that a suppression timer exists for the event, then themethod determines whether to send a message to a peer endpoint inaccordance with the suppression timer. For example, if a threshold ofthe suppression timer has expired, the method 300 may proceed to step320 and send a subsequent notification. However, if the suppressiontimer has not yet expired, the method 300 will not send a notificationand may proceed back to step 310 to detect subsequent errorcondition(s). For instance, a suppression timer may specify thatmessages notifying of a detected attack be sent at most once per second,to prevent floods from the same source, or once every 200 millisecond toprevent multisource floods. This is only one illustrative example. Ifthe error condition detected at step 310 is the first detected errorcondition for an event, the method may simply proceed directly from step310 to step 320.

In step 320, the method 300 sends a notification of the attack to asecond endpoint in the transport layer session. For example, the firstendpoint may create and send a packet (e.g., a TCPv2 packet) comprisingan attack notification message (ANM). The message may include variousdetails regarding the detected attack such as: all or a portion of thesuspected attack code, an offending message fragment, a source of thedetected attack, such as an originating IP address, and the like. In oneembodiment, an attack may comprise a number of packets from one or moresources. Hence, details regarding the attack may comprise a number ofattack messages received, the source address(es) of the packetscomprising the attack, and so forth. In one embodiment, a detectedfailure condition comprises a bad gateway or a broken link. Accordingly,details regarding the failure condition may comprise the address of thebad gateway or link, and interface address for reaching the bad gatewayor link, an error code, if the cause of the failure of the gateway orlink is known, and the like. Although the above assumes only a singlepacket notifying of a detected failure condition or attack, it should benoted that the present disclosure is not so limited. Namely, in other,further and different embodiments, the notification/message may comprisetwo or more packets. In one embodiment, the notification is a subsequentpacket following the expiration of a suppression timer. In oneembodiment, the notification is sent in a packet in an OA&M side-streamto a data session. In one embodiment, the notification message is sentin one or more packets having a form of packet 200 of FIG. 2. Forinstance, the record type field of packet 200 may contain the recordtype “ANM” indicating that the packet is an attack notification message.The payload may comprise the details of the failure condition/attack asdescribed above. In one embodiment, the notification is sent in a packetencrypted using a session key for the transport layer session, asdescribed above. In addition, although step 320 involves notifying asecond endpoint of a detected attack, it should be understood that inone embodiment, a notification may also be provided to an applicationrunning on the first endpoint. For example, a session may be initiatedby an application layer program, such as a web browser initiating asession with a remote web server to obtain a hypertext markup language(HTML) document. Thus, notification of the detected attack may be passedup the protocol stack to the application layer program. The applicationlayer program may choose to respond in any number of ways. For instance,the application layer program may choose to terminate a connection inresponse to an attack, even though the local security policy does notnecessarily require such a drastic response and would allow otheralternatives. Further, in one embodiment, notification is also providedto a security policy manager, which may reside on the first endpointdevice, or may reside on another device, such as a network firewallrouter. For instance, the security policy manager may be responsible forlocal security policy that indicates required or permissible responsesto the detected attack. In addition, in one embodiment, the securitypolicy manager is tasked with sending the notification of the detectedattack to the second endpoint at step 320.

At step 330, the method 300 receives a communication from the secondendpoint proposing a response to the error condition. In one embodiment,the communication comprises a PSA message, which may also be encryptedusing a session key, as described above. For example, the secondendpoint may receive one or more packets (e.g., one or more ANM packets)notifying of a detected error condition from the first endpoint. Uponreceiving information about the detected error condition, the secondendpoint may process the information in order to select a response tothe detected error condition. For instance, the second endpoint mayinclude a security policy manager having one or more security policiesthat may apply in various circumstances. For example, one securitypolicy may specify that a session should be dropped upon a detection ofany suspected attack (a strict security policy). Another security policymay specify that no action should be taken, notwithstanding thedetection of an attack/suspected attack. For example, if thecommunication session is simply supporting a client-server web browsingsession with information that is already made publicly available overthe internet, the security policy may not care. On the other hand, asecurity policy may specify that if a user is logged on to a streamingvideo service and the session is supporting streaming video ofcopyrighted material, then a more severe action (e.g., dropping thesession) should be taken. Another security policy at an endpoint mayspecify that a session should be dropped in response to any detectedattacks on a session involving a peer endpoint on a different network,whereas a detected attack on a session involving only the endpoint and apeer device on the same local network should be handled differently. Theforegoing are only several examples of possible security policies andcorresponding actions. Alternative actions to take in response to adetected failure condition/attack may comprise: loggingparameters/information pertaining to the transport layer session in adatabase (e.g., for future analysis, correlating with information onother suspected attacks against the current session or differentsessions, etc.), upgrading to a more secure cipher suite, e.g., using alarger key size, beginning to encrypt communications using a sessionkey, reducing an acknowledgement window size, re-negotiating a sessionkey, changing session identifiers (e.g., RSID and/or SSID), agreeing torenegotiate session keys at a more frequent intervals, shortening thevalid duration of a session key and re-anchoring/transferring a sessionto a different network, to a different interface or to a differentdevice, among other things. Several exemplary security responses arediscussed below in more detail.

More specifically, in one embodiment a proposed security response maycomprise changing one or more of the session identifiers (e.g., the RSIDand/or SSID). In one embodiment, a change in session identifier(s) isaccomplished through the use of a session re-anchor packet, at the sametime as a session re-anchoring. In another embodiment, a change ofsession identifiers is a separate security response in which one or moreof the devices in the communication session choose a new sessionidentifier and convey the choice to one or more peers. In oneembodiment, the proposed security action may not necessarily propose theimmediate changing of session identifiers, but may comprise a proposalto change session keys more often. For example, the endpoints in asession may have agreed to update session keys according to a particularschedule, but in response to a detected attack, may determine to changesession keys on a more frequent basis. In one embodiment, the proposedsecurity response may actually comprise a re-authentication challenge tothe first endpoint device. For instance, the proposed security responsemay be to continue the session, but only if the first endpoint devicecan successfully pass a re-authentication process of the second endpointdevice.

In still another embodiment, a proposed response may comprise sending anotification to one or more users at one or more of the devices that arepart of the communication session, e.g., through a pop-up windowpresented on a display. For example, if the session supports a creditcard or banking transaction, the proposed response may comprise lockingout one or more features. In this regard, it should be noted that theprocess of determining a security response and the correspondingaction(s) to be taken are not necessarily limited to the transportlayer. Rather, security actions may involve the application layer andeven the solicitation for end user input, e.g., where one or more endusers make the ultimate decision as to whether to continue a transportlayer session, to close the session, to re-anchor via a differentnetwork, etc., and where a security response may comprise actions at theapplication layer, such as locking out certain features, requiring auser to input further credentials, and so forth.

In any case, after selecting a security action, the second endpointsends a message (e.g., in one or more packets, such as a PSA packet asdescribed above) to the first endpoint proposing the selected response.The message is received by the first endpoint at step 330, followingwhich the method 300 may optionally proceed to step 340.

At step 340, the method 300 performs an action in response to receivingthe communication proposing a response to the error condition at step330. For example, the method 300 may simply perform the action proposedin the communication received at step 330. Alternatively, or inaddition, the method 300 may send a confirmation message, which may alsobe encrypted using a session key, as described above. More specifically,the first endpoint may receive a message from the second endpoint (e.g.,a PSA message), the message having a proposed security action/responseto the detected attack. The method 300 may then implement local securitypolicies (e.g., of the first endpoint) to determine if it can agree tothe proposed security action. For example, if the second endpoint is acellular endpoint device, it may propose that the session be transferredfrom itself to a desktop computer. While the second endpoint may deemthis action to provide a greater level of security, the desktop computermay reside in a network that is untrusted by the first endpoint. Forexample, this may violate one or more security policies of the firstendpoint. In this regard, it should be noted that all or a portion step340 may be performed by a security policy manager that may reside withinthe first endpoint device or may be accessible by the first endpointdevice (e.g., in network firewall router). Alternatively, or inaddition, the first endpoint may maintain a list of trusted peers, andif the proposed new endpoint is not on the list, the first endpoint maydecline the transfer. As such, the method 300 may not agree to thesession transfer. Accordingly, in step 340 the method 300 may perform anaction that comprises sending a negative confirmation (e.g., in a SACpacket as described above) declining the proposed response to theattack. The foregoing is only one example. Thus, it should beappreciated that there are various other reasons why a first endpointmight decline a particular security action/response. It should also benoted that a declination of a proposed response may also include acounter-proposal, an invitation to provide a subsequent proposal or maysimply be an outright denial. Thus, in some cases, the second endpointmay receive a counter-proposal, compare the counter-proposal against itsown security policies, and accept, decline or send a furthercounter-proposal, and so forth.

On the other hand, the first endpoint may in fact agree to the proposedresponse to the attack. If so, at step 340 the method 300 may send apositive confirmation (e.g., in a SAC packet as described above)indicating that the proposed action will be followed. For example, aproposed security action/response to the attack may be to startencrypting all data communications using a session key negotiated at thebeginning of the session. Thus, a confirmation message may be sent atstep 340 agreeing to the upgrade. Thereafter, the first endpoint simplybegins sending all subsequent data packets encrypted using the sessionkey, or taking a different security action depending upon what wasproposed in the communication received at step 330.

For example, in one embodiment a proposed security response is to movethe transport layer session to a different interface or networkconnection. For example, the second endpoint may send a PSA messageproposing to re-anchor the session from a wireless local area networkconnection to a cellular network connection. The second endpoint mayinclude a new address that it intends to use in the cellular network aspart of the PSA message. If the first endpoint agrees to accept there-anchoring request, the first endpoint may update an address of thesecond endpoint in a session management table, send a confirmation atstep 340 (e.g., in a SAC packet) and simply begin sending subsequentpackets to the new address in the cellular network. However, in anotherembodiment, the second endpoint may not convey a new address whenproposing a response/security action. Rather, in such an embodiment, thesecond endpoint may propose a session re-anchor as an appropriatesecurity action/response. The method 300 may (at step 340) accept theproposal by conveying a confirmation message. Thereafter, the secondendpoint may send a re-anchor request message beginning the actualprocess of re-anchoring the session. An exemplary process forre-anchoring a session is described in the above mentioned co-pendingcommonly assigned application “Initiating and Maintaining Sessionsbetween Endpoints”, which is incorporated by reference herein in itsentirety.

It should again be noted that the foregoing are merely a few embodimentsof the present disclosure for managing security of a communicationsession in a communication network. As such, the present disclosure isnot strictly limited to any one or more particular examples of securitypolicies, response/security actions and the like that are describedherein. As another example, in one embodiment at step 310, the method300 may send a proposed response to the detected attack along with theinitial notification. Thus, the method 300 may not simply wait for aproposed security action from the second endpoint, but may proactivelymake the first suggestion for an appropriate response, which the secondendpoint may then be tasked with accepting or declining the proposal.

In any case, following step 340 the method 300 proceeds to step 395wherein the method terminates.

FIG. 4 illustrates another exemplary method 400 for managing security ofa communication session in a communication network (e.g., a sessionusing TCPv2 packets). In one embodiment, the method 400 may be performedby a first endpoint device in an ongoing session with one or more otherendpoint devices. For instance, the method 400 may be performed byendpoint device/user equipment 151 in FIG. 1 in communication withendpoint device/user equipment 101. In addition, in one embodiment, thesteps/functions/operations of method 400 may also be performed by acomputing device 500 as described in connection with FIG. 5.

The method 400 begins in step 402 and proceeds to step 410 where themethod receives a notification of an error condition of a communicationsession, e.g., a transport layer session. For example, the notificationmay be received by the method 400 at a first endpoint in thecommunication session. In one embodiment, the notification comprises anattack notification message/packet (e.g., an ANM packet) that is sent bya second endpoint in the communication session. The notification messagemay be sent and received substantially as described above in connectionwith steps 320 and 330 of the method 300.

Following step 410, the method 400 proceeds to step 420 where the methodselects a response to the error condition. The selection of a responseto the error condition may proceed in substantially the same manner asdescribed above in connection with step 330 of the method 300 above. Forexample, the method 400 may perform substantially the same functions andfollow the same processes of the “second endpoint” described in themethod 300 above. For instance, the method 400 may receive an attacknotification message notifying of a suspected attack. The suspectedattack may comprise an improperly formed session management/OA&Mmessage, such as an improperly formed or improperly encrypted re-anchorrequest, attack notification message, session transfer message, and thelike, or a failure condition such as a bad gateway or a broken link. Inresponse, the method 400 may determine any one or more securityresponses such as: logging parameters/information pertaining to thesession in a database (e.g., for future analysis, correlating withinformation on other suspected attacks against the current session ordifferent sessions, etc.), dropping the session, taking no action,re-negotiating or upgrading to a more secure cypher suite, codec and/orcryptographic algorithm, beginning to encrypt communications using asession key, re-negotiating a session key, changing session identifiers(e.g., RSID and/or SSID), and re-anchoring/transferring a session to adifferent network, to a different interface or to a different device,among other things. The method 400 may implement one or more securitypolicies in selecting a response to the error condition. For example,the method 400 may implement local security policies of a securitypolicy manager residing on an endpoint device (e.g., endpoint device 151in FIG. 1).

Following step 420, the method 400 proceeds to step 430 where the methodsends a communication to a second endpoint in the transport layersession proposing a response to the error condition. In one embodiment,the communication comprises a proposed security action (PSA) packet sentby the method 400 via the first endpoint to a second endpoint. In oneembodiment, the communication sent at step 430 is encrypted using asession key for the communication session.

Following step 430 the method 400 proceeds to step 495 wherein themethod terminates.

It should be noted that although not explicitly specified, one or moresteps of the respective methods 300 and 400 described herein may includea storing, displaying and/or outputting step as required for aparticular application. In other words, any data, records, fields,and/or intermediate results discussed in the method can be stored,displayed, and/or outputted to another device as required for aparticular application. Furthermore, operations, steps or blocks inFIGS. 3 and 4 that recite a determining operation or function, orinvolve a decision, do not necessarily require that both branches of thedetermining operation be practiced. In other words, one of the branchesof the determining operation can be deemed as an optional step.Furthermore, operations, steps or blocks of the above described methodscan be combined, separated, and/or performed in a different order fromthat described above, without departing from the example embodiments ofthe present disclosure.

It should be noted that the above examples are only illustrative. Inother words, protocol fields in addition to those described above may beincluded in the TCPv2 header and/or payload. Similarly, the exemplaryrecord-types/message-types described above are only illustrative innature. Thus, it should be understood that numerous other, further anddifferent record types for data, OA&M messaging and other purposes fallwithin the scope of the present disclosure. As mentioned above,embodiments of the present disclosure (TCPv2) are extensible insofar asadditional record-types may be created and defined as necessary forvarious purposes. In this regard, it should also be noted that oneembodiment may use TCP packets according to the existing protocol thatare modified to be non-compliant with the protocol. For instance, in oneembodiment the header according to the existing TCP format is modifiedto convey OA&M messages pertaining to a detected attack. For example,the options field in the TCP header contains 24-32 bits (with padding)that may be used to convey notification of an attack. Different codes ofup to 24-32 bits may be selected to convey notification of differenttypes of attacks. In one embodiment, the packet may comprise anacknowledgement packet (ACK) with no data (payload length zero) having asequence number the same as the last ACK packet. This combination offeatures may signal to a receiving device that the packet is notactually an ACK packet, but comprises an attack notification and thatthe bits in the options field should be read as an attack notification.While it may not be possible to convey detailed information pertainingto the attack in this way (e.g., it may not be possible to include allof the offending code), a limited attack notification-response messageexchange can nevertheless be provided in this manner.

In addition, although several of the above examples describe sessionsbetween only two peer hosts, the present disclosure is not so limited.Namely, in other, further and different embodiments a TCPv2 session maycomprise a multicast session (e.g., a one-to-many type session, aconference type session, and the like involving a plurality of peers ina single session). Internet Protocol version 6 (IPv6) specificallycontemplates multicast communications and includes multiple destinationIP address fields in the IP header. As such, security response packets(e.g., ANM, PSA and SAC packets), session establishment packets, datapackets, acknowledgment packets, re-anchoring notification packets, andany other type of TCPv2 packet not specifically described herein, may bemulticast to various peers at various different IP address. Likewise,any one or more peers in a multicast session may also send notificationsof detected attacks, propose security responses and send confirmationsin the same manner described above.

FIG. 5 depicts a high level block diagram of a general purpose computersuitable for use in performing the methods, steps, operations and/orfunctions described herein. As depicted in FIG. 5, the system 500comprises a processor element 502 (e.g., a CPU), a memory 504, e.g.,random access memory (RAM) and/or read only memory (ROM), a module 505for managing security of a communication session in a communicationnetwork, and various input/output devices 506 (e.g., storage devices,including but not limited to, a tape drive, a floppy drive, a hard diskdrive or a compact disk drive, a receiver, a transmitter, a speaker, adisplay, a speech synthesizer, an output port, and a user input device(such as a keyboard, a keypad, a mouse, and the like)).

It should be noted that the present disclosure can be implemented insoftware and/or in a combination of software and hardware, e.g., usingapplication specific integrated circuits (ASIC), a general purposecomputer or any other hardware equivalents, e.g., computer readableinstructions pertaining to the method(s) discussed above can be used toconfigure a hardware processor to perform the steps, functions and/oroperations of the above disclosed methods. In one embodiment, thepresent module or process 505 for managing security of a communicationsession in a communication network can be implemented ascomputer-executable instructions (e.g., a software program comprisingcomputer-executable instructions) and loaded into memory 504 andexecuted by processor 502 to implement the steps, functions andoperations as discussed above. As such, the present process 505 formanaging security of a communication session in a communication network(including associated data structures) of the present disclosure can bestored on a non-transitory (e.g., tangible and physical) computerreadable storage medium, e.g., RAM memory, magnetic or optical drive ordiskette and the like. In this regard, it should be noted that any oneor more of the devices described in connection with the above FIGS. 1-4may be embodied by the system 500.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example only, and notlimitation. Thus, the breadth and scope of a preferred embodiment shouldnot be limited by any of the above-described exemplary embodiments, butshould be defined only in accordance with the following claims and theirequivalents.

What is claimed is:
 1. A first endpoint for managing a communicationsession, the first endpoint comprising: a processor; and anon-transitory computer-readable medium storing instructions which, whenexecuted by the processor, cause the processor to perform operations,the operations comprising: detecting an error condition associated withthe communication session, wherein the first endpoint and a secondendpoint are participating in the communication session, wherein theerror condition comprises an attack on the communication session,wherein the attack comprises an invalid re-anchor request; sending anotification of the error condition to the second endpoint using a firsttransport layer session management message of a transport layer session,wherein the communication session includes the transport layer session,wherein a header of the first transport layer session management messageincludes a record type, wherein the record type indicates that a payloadof the first transport layer session management message contains sessionmanagement information; and receiving a communication from the secondendpoint via a second transport layer session management message of thetransport layer session, the communication proposing a response to theerror condition.
 2. The first endpoint of claim 1, wherein the responsecomprises switching to a different set of session identifiers for thetransport layer session.
 3. The first endpoint of claim 1, wherein theresponse comprises re-negotiating a session key for the transport layersession.
 4. The first endpoint of claim 1, wherein the responsecomprises re-anchoring the transport layer session.
 5. The firstendpoint of claim 1, wherein the response comprises transferring thetransport layer session to a different endpoint.
 6. The first endpointof claim 1, wherein the response comprises dropping the transport layersession.
 7. The first endpoint of claim 1, wherein the responsecomprises continuing the transport layer session without a modification.8. The first endpoint of claim 1, wherein the response comprisesrenegotiating a cryptographic algorithm for the transport layer session.9. The first endpoint of claim 1, wherein the response compriseschanging a frequency for renegotiating a session key for the transportlayer session.
 10. The first endpoint of claim 1, wherein the responsecomprises re-authenticating the first endpoint.
 11. The first endpointof claim 1, wherein the first transport layer session management messageis encrypted using a session key of the transport layer session.
 12. Thefirst endpoint of claim 1, wherein the transport layer session comprisesa transmission control protocol session that is identified by arequesting system session identifier and a serving system sessionidentifier.
 13. The first endpoint of claim 1, the operations furthercomprising: sending a further communication via a third transport layersession management message of the transport layer session proposing adifferent response.
 14. A first endpoint for managing a communicationsession, the first endpoint comprising: a processor; and anon-transitory computer-readable medium storing instructions which, whenexecuted by the processor, cause the processor to perform operations,the operations comprising: receiving a notification of an errorcondition associated with the communication session from a secondendpoint, wherein the error condition comprises an attack on thecommunication session, wherein the attack comprises an invalid re-anchorrequest, wherein the first endpoint and the second endpoint areparticipating in the communication session, wherein the notification ofthe error condition is received via a first transport layer sessionmanagement message of a transport layer session, wherein a header of thefirst transport layer session management message includes a record type,wherein the record type indicates that a payload of the first transportlayer session management message contains session managementinformation, wherein the communication session includes the transportlayer session; selecting a response to the error condition; and sendinga communication to the second endpoint using a second transport layersession management message of the transport layer session, thecommunication proposing the response to the error condition.
 15. Thefirst endpoint of claim 14, wherein the response comprises at least oneof: switching to a different set of session identifiers for thetransport layer session, re-negotiating a session key for the transportlayer session, re-anchoring the transport layer session, transferringthe transport layer session to a different endpoint, dropping thetransport layer session, or continuing the transport layer sessionwithout a modification.
 16. A non-transitory computer-readable mediumstoring instructions which, when executed by a first endpoint comprisingat least one processor, cause the at least one processor to performoperations for managing a communication session, the operationscomprising: receiving a notification of an error condition associatedwith the communication session from a second endpoint, wherein the errorcondition comprises an attack on the communication session, wherein theattack comprises an invalid re-anchor request, wherein the firstendpoint and the second endpoint are participating in the communicationsession, wherein the notification of the error condition is received viaa first transport layer session management message of a transport layersession, wherein a header of the first transport layer sessionmanagement message includes a record type, wherein the record typeindicates that a payload of the first transport layer session managementmessage contains session management information, wherein thecommunication session includes the transport layer session; selecting aresponse to the error condition; and sending a communication to thesecond endpoint using a second transport layer session managementmessage of the transport layer session, the communication proposing theresponse to the error condition.
 17. The non-transitorycomputer-readable medium of claim 16, wherein the response comprises atleast one of: switching to a different set of session identifiers forthe transport layer session, re-negotiating a session key for thetransport layer session, re-anchoring the transport layer session,transferring the transport layer session to a different endpoint,dropping the transport layer session, or continuing the transport layersession without a modification.
 18. The non-transitory computer-readablemedium of claim 16, wherein the response comprises renegotiating acryptographic algorithm for the transport layer session.
 19. Thenon-transitory computer-readable medium of claim 16, wherein theresponse comprises changing a frequency for renegotiating a session keyfor the transport layer session.
 20. The non-transitorycomputer-readable medium of claim 16, wherein the response comprisesre-authenticating the first endpoint.